CVE-2026-73447: Security Advisory 0162 - gNSI Certz/Bootz OS Command Injection via Crafted Rotate Request

Published Sep 16, 2026

Updated

A privileged attacker can exploit certain operation to execute arbitrary commands with root privileges, leading to full device compromise. An authenticated user can exploit gRPC Network Security Interface (gNSI) Certz service on Arista EOS-based products to escalate privileges and execute arbitrary OS commands via a crafted Certz Rotate request. The Bootz service is also affected.

Affected Software

2 affected components

Arista Networks Arista EOS

Arista EOS-based products

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Arista EOS 4.33.x to a version that resolves this vulnerability.
Fixed in 4.33.9M
Upgrade
Upgrade Arista EOS 4.34.x to a version that resolves this vulnerability.
Fixed in 4.34.7.1M
Upgrade
Upgrade Arista EOS 4.35.x to a version that resolves this vulnerability.
Fixed in 4.35.6M
Upgrade
Upgrade Arista EOS 4.36.x to a version that resolves this vulnerability.
Fixed in 4.36.1F

Event History

Sep 16, 2026

CVE Published

via MITRE·06:04 AM

Data Sourced

via MITRE·06:04 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need?

The attacker must be authenticated and able to send a crafted gNSI Certz Rotate request. The advisory describes the attacker as privileged, so unauthenticated exploitation is not indicated by the available information.

Which services are implicated?

The gNSI Certz service is affected through crafted Rotate requests. The Bootz service is also identified as affected.

What is the likely impact of successful exploitation?

Successful exploitation can execute arbitrary operating-system commands with root privileges. This can lead to privilege escalation and full device compromise.